Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently we had a web server running Apache (2.2.3) compromised and are in the process of cleaning data and moving to another server to that we can rebuild the current one.

We want to try and figure out what was done after we've finished moving to a new server. We've got the easy stuff, the injected PHP code in numerous files and PHP inserted into the database.

At the same time we still have tags with-in the of html documents changed or a big blob of text inserted right after the opening tag in document. This happens on all HTML files sent to search engines be it from a static HTML file or generated from a PHP file. It will also redirect anyone coming from search engines to another site as long as their referer contains certain keywords.

If the page is cached in our reverse proxy this no longer happens, which has helped us narrow it down to something potentially in Apache. This is where I wonder "Where do I look?" we've looked for extra modules added in and checked in our config files and have yet to find anything that sticks out.

Where might be some other places to check so we can see what exactly is going on?

share|improve this question
    
Are you sure it was apache which was compromised and not the server itself? –  Kyle Hudson Mar 30 '11 at 19:04
    
Well yes, the server itself is compromised. I could have worded it a little better. My question relates to trying to figure out what is inserting/replacing the text on the server pages. –  DMClark Mar 30 '11 at 21:22
3  
In most cases, it doesn't really matter. ANY part of a compromised server could be itself infected, and the only option is to start fresh. –  Andrew M. Mar 30 '11 at 23:02
3  
possible duplicate of My server's been hacked EMERGENCY –  GregD Mar 31 '11 at 14:25

2 Answers 2

If you know the key words, you could grep all the files in your / root directory for them. Then manually go through the results.

share|improve this answer

Code inserted into files... the first thing I would think is compromised user. Simple FTP hack-job. In my experience (which is fairly considerable being a front-line sys admin for a web hosting company) weak password was it more times that people like to admit. There aren't a lot of ways to write to a file and this is one of them.

My earnest recommendation is to clean it all up and then:

  1. Disable FTP altogether. Ideally through firewall settings.
  2. Enforce strict passwords and also regular changing of passwords.
  3. Often you will be tempted to allow loose permissions on files and directories. Never allow global write. There is always a better way.
  4. Don't use PHP code that isn't from a well-respected source. Trash scripts from Google searches just aren't worth it.

If you really want to track down what event might have taken place.... search for IP addresses you aren't familiar with in your FTP logs. If you think it was a script hack, check your /tmp directory for hacker scripts. Any executable is bad news, as are any scripts at all. Check your applicable apache logs for references to the affected files, especially if those files are not often accessed.

Remember that you can wipe out code from files en masse with:

sed -ie s/regexorstring//g *

...run in the appropriate directory. That is just a find and replace (rudimentary) that will grab any string you want gone and will remove it. A little regular expressions in there will make it pretty easy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.